This was 4 days ago and the vast majority of distros are still unpatched. Hell, the vast majority of rentable VPS servers are still unpatched meanwhile this exploit literally rewrites the cache which means it can escape docker/kubernetes containers that most VPS companies offer.Why the fuck are distros and companies so slow at patching this? At this point I consider virtually every VPS compromised and loaded with root-level backdoors.
i think you should stop getting your news from reddit
>>108745205>it can escape docker/kubernetes containersproof?>At this point I consider virtually every VPS compromised and loaded with root-level backdoors.It's a local privilege escalation, you first have to actually get remote access to a machine to exploit it.
>>108745354Yes, you register to the VPS and then ssh in and use the exploit.
Does it work on Android?
>>108745205the whole internet would be down if it was not patched and you could exploit it cross vm, container or whatever AWS/Azure/Gcloud uses
>>108745398Oh no! I now have root on the VPS I just created. I guess I hacked myself.
>>108745205>HOLY SHIT THE MOST SERIOUS CVE EVER FOUND IN LINUX KERNEL HOLY SHIT PANIC AND SELL EVERYTHING>4 days passed>nothing serious happenedMaybe, just maybe, because it's not that exploitable?
>>108745398anon... do you not understand that the V in vps stands for VIRTUAL as in VIRTUALIZED using VIRTUALIZATION
Patched on my machine. That's all that matters.
>>108745412no, unfortunately not
>>108745205>if you can execute arbitrary code on a computer, you can get rootwow no shit?it doesn't even punch through hypervisors, so cloud hosts / vps are unaffected. literally a dime a dozen 'exploit'
>>108745205Any proof of concept for android?
>>108745463>implyingdo you ever consider that having root inside the container is still bad? for example, misconfigurations in this regard could enable me to bypass your mTLS service mesh
>>108745434I am aware. HOWEVER.Most of the "virtual" private servers actually use kubernetes or docker which you can just escape with this exploit.
>>108745205I'm pretty sure some distros received a patch and you just don't know it. Mint didn't receive a kernel patch but received a kmod update with the patch for the vulnerability.
>>108745481that's not how that works
>>108745205another reason to use windows
No idea what you guys do get so fuzzy about it, but the script does not break out of kubernetes or docker. You just become root in your VPS, which you already had. At least in all VPS that I own, I am using a normal user and then su - to root.Pffft call me when I can get root outside of the VPS with a better script.
>>108745528AHEM
>>108745546now read the false claim made in >>108745481
>>108745546Wish you all the best and good luck on your hunt.Post your findings here then.
Doesn't work on my machine
>>108745205You could have a 1000 exploits like Copy Fail and it wouldn't be as relevant as the one recent cPanel exploit.Local Linux exploits simply don't matter outside of Android and ChromeOS. If you assume ACL's protect you from anything more than an accidental rm -rf, you are very naive. You don't get a new zero day literally every day any more like 10 years ago, but every couple of weeks still. All the new complex kernel features are full of them. Every major hacker will be sitting on a stash to use for a new chain when needed.
>every distro since 2017is this like a systemd thing?
>>108745925Worse, it is a kernel thing.
>>108745205WSL status?
>>108745205>docker escapei wonder if this could have been triggered using a minecraft server plugin, then be able to reek havok on the host box
>>108745931gentoochads win again
>>108745432It's exploitable enough.I've seen numerous successful RCE attacks on webservers. There's plenty of incentives for hackers to run code on remote servers even if they aren't root.Eveb basic apache best practices from 20 years ago involve running the web server as a user that doesn't have broad write perms to the docroot.It's really fucking easy for webdevs to program a backend full of exploitable holes. They do it all the time. Luckily, the consequences of those hacks are usually fairly limited and localized. But copyfail would make those exploits far more devastating. That the combo hasn't been used AND DISCOVERED within 4 days means nothing.
>>108745474No, he's an unemployed retard with no experience outside his basement porno server.
Vast majority of distros/=/vast majority of Linux usersFedora, Debian, Ubuntu, Mint, Arch, etc. have already been patched, some within the same day as articles saying they were vulnerable. Some meme used by 5 people may not be patched yet.
>>108745546This still isn't a container escape. You'd still need arbitrary code execution on the host to actually run host commands as root, and if you had that, then you can just run the exploit on the host.
>>108745481No they dont lmao,.docker isnt virtualization
>fixed in 6.19.126.19.12 released over three weeks ago for all my systems. Don't care not my problem etc
>>108746193You can rewrite the cache of any executable, which means if you rewrite the cache for /bin/uptime for example and the host cron job runs this program, it will run the program from the cache (your program). The problem is because containers and hosts share the same system executables ... The container has read-only access to system executables which is all you need.
It is very important in exposing hypocrisy. Things like wayland shills, they argue that severely lacking functionality in every-day desktop tasks due to a poorly designed architecture are "safety features" fall on its face with this kind of escalation.Likewise some linux desktop shills will argue that it's so safe compared to windows.Yeah it matters for servers but escalation is not that severe. The problem is always RCE. It's not breaking through hypervisors, only the cheapest bottom of the barrel 512mb "vps"s run on kubernetes or such rather than real virtualization.
>>108746008It's a privilege escalation, not a code execution bug. You use this to get to root, not to gain foothold into the server. This is a nothingburger, unless you accept arbitrary shell scripts as input over ssh without auth
>>108746262Do containers actually have access to system executables? Generally, the whole container environment, including system executables, is separate. Unless you do something retarded like mount /usr/sbin into your container, then the only system executables you can access will be in your private environment in /var/lib/docker or wherever.
None of my systems even had the offending driver installed
>>108745481Hope one day to see someone to vibecode a service like that
>>108745205>This was 4 days ago and the vast majority of distros are patched.
>>108745217fpbp
Fedora CoreOS does not have this problem.
>>108745933usecase for WSL?>>108745205>it can escape docker/kubernetes containersnig/g/er you don't know what you talk aboutsudo sed -i 's/^GRUB_CMDLINE_LINUX_DEFAULT="/&initcall_blacklist=algif_aead_init /' /etc/default/grub#update grub and rebootfor k8s:kubectl apply -f https://raw.githubusercontent.com/cozystack/copy-fail-blocker/main/manifests/copy-fail-blocker.yamlmore here:https://github.com/cozystack/copy-fail-blocker
>>108748145redhat was the first company germans reported toOnly week after to ubuntujust try to understand corpo world, son
>>108745205both my Debian Stable and NixOS Unstable are long patched now
>>108746292Illiterate retard
>>108745205LPE is a nothingburger
>>108745205Qubes chads can't stop winning!
>>108748819>kubectl apply -f https://raw.githubusercontent.com/cozystack/copy-fail-blocker/main/manifests/copy-fail-blocker.yamlVile Schlomo
>>108748819>usecase for WSL?I'm just curious... obviously not curious enough to install winblows, even in a VM, but still curious enough to ask.
>>108750996All programming tasks and anything that interacts with git or ssh is better in a Linux VM than it is in native Windows. PuTTY is utter fucking dogshit. "git for Windows" is literally a Linux VM because there's no other solution.
Docker/Kubernetes sandbox escapes are just as dime a dozen as local privilege escalation. User privileges and containers alike are only to protect against accidental unwanted interactions, not intentional. It isolates the user, not an attacker. It's not even a hurdle, it's a baby safety gate. Anyone who even counts these as protection in depth is being silly.If this knocked through gVisor or Kata Containers you might have a point, it doesn't.
>>108751028ai generated comment
>>108745205>>108745481>doesn't know what a vps is>doesn't understand that you can give fake root to a container>doomposts about nothingburger vuln that needs you to have access already>linux bad, open source distro model badYou're a jeet working for microslop.>If you assume ACL's protect you from anything more than an accidental rm -rf, you are very naiveExactly, they were never even meant for security.
>>108747552>Do containers actually have access to system executables?Attack surface for container escapes is so fucking huge that Kubernetes don't even offer a bug bounty for it."not eligible ... Container escalations and escapes to the host, unless the attack path traverses a Kubernetes process (e.g. kubelet)."That's why gvisor/Kata exist.
>>108747552>>108751176I don't use kubernetes bloat, but as long as you never give real root to the container, don't bind mount anything spicy and limit the syscalls it can do there's not much the container can do to escape other than kernel-level vulnerabilities, it's an overrated concern.
>>108751243>other than kernel-level vulnerabilitieswhich is literally this thread, retard
you would be an idiot for running kubernetes on the host os anyway. There should always be a hypervisor between your host and the containers, at aws we used firecracker but there are probably a billion options.
>>108751261It doesn't apply, if you're a sane person you are remapping the container root account to a non-root account and you're not bind-mounting the /usr/bin or whenever you keep your system executables to the container, since the container is running inside it's own directory hierarchy it has no access to any of that stuff.This exploit can give you root inside the container which is worthless.
>>108751328>There should always be a hypervisorCargo cult behaviour.
>>108751332The whole point of containers is that they share the kernel and system executables.
>>108751341They only share the kernel, why would you share the system executables?
>>108751341>The whole point of containers is that they share the kernel and system executables.People use and design containers for a lot of things. Standard containers are like that and provide defacto no security isolation, the attack surface is too huge to assume otherwise.If you want containers with a more reasonable attack surface, those exist too. You just have to sacrifice some efficiency and/or compatibility.
testing the kernel
